{"record":{"id":"5ff21fbdd93fc311","repo":"github/copilot-sdk","slug":"linuxmuslclihash-must-be-a-sha-256-hash-d-bytes","errorCode":null,"errorMessage":"LinuxMuslCliHash must be a SHA-256 hash (%d bytes), got %d bytes","messagePattern":"LinuxMuslCliHash must be a SHA-256 hash \\((.+?) bytes\\), got (.+?) bytes","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"go/internal/embeddedcli/embeddedcli.go","lineNumber":73,"sourceCode":"\tLinuxMuslRuntimeExecutableHash []byte\n\tLinuxMuslRuntimeNode           io.Reader\n\tLinuxMuslRuntimeNodeHash       []byte\n\tLinuxMuslRuntimeAssets         io.Reader\n\tLinuxMuslRuntimeAssetsHash     []byte\n\n\tDir     string\n\tVersion string\n}\n\nfunc Setup(cfg Config) {\n\tif cfg.Cli == nil {\n\t\tpanic(\"Cli reader is required\")\n\t}\n\tif len(cfg.CliHash) != sha256.Size {\n\t\tpanic(fmt.Sprintf(\"CliHash must be a SHA-256 hash (%d bytes), got %d bytes\", sha256.Size, len(cfg.CliHash)))\n\t}\n\tif cfg.LinuxMuslCli != nil && len(cfg.LinuxMuslCliHash) != sha256.Size {\n\t\tpanic(fmt.Sprintf(\"LinuxMuslCliHash must be a SHA-256 hash (%d bytes), got %d bytes\", sha256.Size, len(cfg.LinuxMuslCliHash)))\n\t}\n\tif cfg.LinuxMuslRuntimeLib != nil && len(cfg.LinuxMuslRuntimeLibHash) != sha256.Size {\n\t\tpanic(fmt.Sprintf(\"LinuxMuslRuntimeLibHash must be a SHA-256 hash (%d bytes), got %d bytes\", sha256.Size, len(cfg.LinuxMuslRuntimeLibHash)))\n\t}\n\tvalidateRuntimePairConfig(cfg.RuntimeExecutable, cfg.RuntimeExecutableHash, cfg.RuntimeNode, cfg.RuntimeNodeHash, \"\")\n\tvalidateRuntimePairConfig(cfg.LinuxMuslRuntimeExecutable, cfg.LinuxMuslRuntimeExecutableHash, cfg.LinuxMuslRuntimeNode, cfg.LinuxMuslRuntimeNodeHash, \"LinuxMusl\")\n\tvalidateOptionalHash(cfg.RuntimeAssets, cfg.RuntimeAssetsHash, \"RuntimeAssetsHash\")\n\tvalidateOptionalHash(cfg.LinuxMuslRuntimeAssets, cfg.LinuxMuslRuntimeAssetsHash, \"LinuxMuslRuntimeAssetsHash\")\n\tsetupMu.Lock()\n\tdefer setupMu.Unlock()\n\tif setupDone {\n\t\tpanic(\"Setup must only be called once\")\n\t}\n\tif pathInitialized {\n\t\tpanic(\"Setup must be called before Path is accessed\")\n\t}\n\tconfig = cfg\n\tsetupDone = true","sourceCodeStart":55,"sourceCodeEnd":91,"githubUrl":"https://github.com/github/copilot-sdk/blob/cd8cf15dc3f9e762615790aaed0a771a0f392755/go/internal/embeddedcli/embeddedcli.go#L55-L91","documentation":"When Config.LinuxMuslCli is provided (an alternate musl-static CLI binary for Linux), Setup requires its companion LinuxMuslCliHash to be a valid 32-byte SHA-256 digest; otherwise it panics. Optional assets carry mandatory hashes whenever present so installs can be verified.","triggerScenarios":"Calling Setup with a non-nil LinuxMuslCli but a LinuxMuslCliHash that is empty, hex-encoded as raw bytes, truncated, or otherwise not exactly sha256.Size bytes.","commonSituations":"Adding musl build support and wiring the binary but forgetting the hash field, reusing the wrong asset's hash, or passing a hex string where raw digest bytes are expected.","solutions":["Set LinuxMuslCliHash to the raw 32-byte sha256.Sum256 of the LinuxMuslCli bytes","Use hex.DecodeString if the digest is only available as hex text","Verify pairing: LinuxMuslCli bytes and LinuxMuslCliHash must come from the same artifact","Guard before Setup: if cfg.LinuxMuslCli != nil && len(hash) != sha256.Size { fix }"],"exampleFix":"// before\nSetup(Config{LinuxMuslCli: muslReader, LinuxMuslCliHash: []byte(hexDigest)})\n// after\nraw, _ := hex.DecodeString(hexDigest)\nSetup(Config{LinuxMuslCli: muslReader, LinuxMuslCliHash: raw})","handlingStrategy":"validation","validationCode":"if linuxMuslCli != nil && len(linuxMuslCliHash) != sha256.Size {\n\treturn errors.New(\"LinuxMuslCliHash must be raw 32-byte SHA-256\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Whenever you add an optional asset, immediately wire its hash from the same build step","Generate the musl CLI and its digest in one CI job","Keep hash fields adjacent to their asset fields in Config construction","Assert len==sha256.Size for every configured hash in tests"],"tags":["go","sha256","config","linux-musl"],"backgroundTag":"invalid-argument-value","analyzedSha":"cd8cf15dc3f9e762615790aaed0a771a0f392755","analyzedAt":"2026-09-09T18:32:31.973Z","contentChangedAt":"2026-09-09T18:32:31.973Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}